AI accounts and verified identities are now criminal market commodities

At a glance

What this is: Kasada's Q1 2026 threat intelligence report says premium AI access and verified identities are being industrialised on criminal markets, with AI accounts, verification bypasses, and agent-focused attacks all scaling together.

Why it matters: IAM, fraud, and AI security teams need to treat verification, agent identity, and post-authentication behaviour as linked controls because adversaries now monetise all three as part of the same attack economy.

By the numbers:

• In Q1 2026, that number was 3,845, a 640x increase against essentially flat supply.
• 13.2 million account sales on criminal marketplaces in Q1 were tagged verified, KYC, or 2FA.
• Those accounts generated $24.6 million in observed revenue.

Context

The security gap here is not simply better phishing or faster botting. Criminal markets are now pricing premium AI access, verified accounts, and identity bypass capabilities as durable assets, which means defenders are facing a blended problem across IAM, fraud, and AI governance.

In parallel, AI agents are becoming a new identity class with employee-like access paths. That creates a control problem around issuance, monitoring, and offboarding, especially when agents hold persistent credentials and can act without direct human supervision.

Key questions

Q: What breaks when verification is treated as a one-time gate?

A: A one-time gate misses the fact that attackers can buy, fabricate, or bypass identities after the initial check. When verification is not paired with behavioural monitoring, device reputation, and post-authentication review, fraudulent users can persist, reuse access, and move between services with very little friction.

Q: Why do AI agents create a different identity risk than human users?

A: AI agents create different identity risk because they operate autonomously, act at machine speed, and often need broad, continuous access to data, tools, and systems. Unlike human users, they can spawn, clone, and chain actions across environments, making misuse harder to spot and contain. Their identities are usually service-based, token-driven, and short-lived, so governance must cover lifecycle, least privilege, and authorization boundaries continuously.

Q: What are the signs that verification controls are being commercialised?

A: Look for repeated onboarding success by suspicious accounts, spikes in liveness or document failures, reuse of the same device or behavioural patterns, and marketplace evidence of verified or KYC-tagged accounts being sold. Those signals mean the control is being worked around as a service, not simply bypassed once.

Q: Should organisations govern AI agents differently from chatbots?

A: Yes. Chatbots mainly expose content risk, while AI agents create action risk because they can decide, select tools, and execute in live systems. Governance has to focus on delegated authority, business-process containment, and runtime boundaries rather than conversation safety alone.

Technical breakdown

Why criminal markets now price AI access like infrastructure

The report describes premium AI accounts as a commodity because free-tier capability no longer satisfies attacker workflows. Criminal buyers are paying for access that improves throughput, evasion, and reliability, which turns account ownership into a provisioning problem rather than a one-off abuse event. The operational shift matters: once AI access is monetised, adversaries can resell it, recycle it, and integrate it into fraud or botting pipelines. The relevant governance question is no longer whether AI is used by attackers, but how access to AI services is acquired, transferred, and sustained at scale. See the AI Infrastructure Workload Identity Guide.

Practical implication: Treat premium AI account access as a governed asset class with lifecycle controls, monitoring, and revocation paths.

How verification bypass creates a parallel identity market

Kasada's report shows that verification itself has become a product line. Services such as selfie liveness bypass, document templates, 2FA interception bots, and synthetic identity packages let attackers move through onboarding gates that were intended to stop abuse. The underlying failure is a control stack that treats identity proofing as a single checkpoint instead of an ongoing trust decision. Once a fabricated identity passes the front door, the downstream session may look legitimate unless behavioural and device signals are still being evaluated after authentication.

Practical implication: Shift fraud and IAM controls from point-in-time verification to continuous post-authentication risk evaluation.

Why AI agents behave like a new insider class

AI agents with API keys, persistent credentials, and autonomous execution rights now resemble insiders from a control perspective, even when they are not human. The report's point is that adversaries are already targeting those agent credentials and the agent configuration files that define what the system can do. That means the attack surface extends beyond secrets to the identity, policy, and memory attached to the agent. Governance needs to cover both what the agent may access and what it may remember or execute during a task. Read Threat Modelling AI Agents.

Practical implication: Manage AI agent identities as privileged workloads and remove standing access wherever a task can be issued on demand.

Threat narrative

Attacker objective: The objective is to acquire reusable trusted access that can support fraud, bot operations, and AI abuse without triggering routine verification controls.

1. Entry occurs through purchased premium AI accounts, verification-bypass services, or synthetic identities that clear onboarding checks.
2. Credential access expands when attackers use account sales, 2FA interception, and agent configuration theft to obtain durable access paths.
3. Escalation follows when those identities are reused across platforms or attached to autonomous agents that can operate with employee-equivalent privileges.
4. Impact is the industrialisation of fraud, botting, and AI abuse at scale, with identities and access sold as reusable commodities.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Verification has become a marketplace, not a control boundary. The report shows adversaries pricing verified, KYC, and 2FA-tagged accounts as inventory, which means onboarding checks are now being bought, sold, and reused rather than merely bypassed. That shifts the defender's problem from identity proofing alone to trust persistence after issuance. Practitioners should treat proofing as one layer in a larger fraud control model.

AI agents are now an identity governance problem, not just an AI governance problem. Once agents hold API keys, persistent credentials, and task execution rights, they operate as privileged non-human identities that need lifecycle control. The report aligns with the need to govern AI infrastructure identities as a distinct class because the harm comes from delegated access, not model output alone. Practitioners should map agent ownership, scope, and revocation to the same discipline used for other privileged identities.

Long-lived trust assumptions are failing faster than the controls built around them. The report's account-market data and agent-targeting trends point to a named concept we can call trust monetisation, where adversaries convert identity assurance into a resaleable asset. That creates pressure on IAM, fraud, and SOC teams to coordinate around post-authentication behaviour instead of relying on a single verification event. Practitioners should expect attackers to target the weakest layer in the assurance chain, not the strongest.

The insider threat has split into human misuse and machine misuse. The report shows both employees reselling goods and AI agents acting with employee-equivalent access, which means one insider model no longer covers the risk. Human judgment failures and machine execution speed now coexist in the same environment. Practitioners should separate policy, monitoring, and response paths for people and agents rather than forcing both into one control model.

What this signals

Trust monetisation: identity assurance is now being converted into resaleable market value, which means proofing, verification, and post-authentication monitoring can no longer be managed as separate programmes. The practical response is to treat every trusted identity event as the start of a longer assurance lifecycle, not the end of it.

The operational lesson is that fraud teams, IAM teams, and AI governance teams now share the same risk surface. If the programme only measures whether an identity got in, it will miss whether a person, bot, or agent is still trustworthy after entry.

For practitioners

• Govern AI agents as privileged workloads Assign each agent an owner, a defined task scope, and a revocation path so access can be removed as cleanly as it is issued.
• Move from checkpoint verification to continuous trust scoring Extend fraud and IAM decisions beyond signup by evaluating device, behaviour, and session anomalies after authentication succeeds.
• Hunt for verification bypass patterns in onboarding flows Review liveness, document, and 2FA steps for repeated failure modes that correspond to the bypass services described in the report.
• Separate human insider and agent insider controls Use different monitoring, approval, and offboarding paths for employees and AI agents because their abuse patterns and response thresholds differ.

Key takeaways

• AI account sales and verified identity markets are scaling together, which shows that attackers are industrialising access rather than improvising it.
• The evidence points to a control gap after authentication, where verification is still treated as the end of trust instead of the beginning.
• Governance needs to cover AI agents, synthetic identities, and post-authentication behaviour as one connected risk surface.

Related NHI Mgmt Group resources: AI Infrastructure Workload Identity Guide · Threat Modelling AI Agents · Threat Intelligence Guide · Threat Intelligence Platform Buyer's Guide

Key terms

• Trust Monetisation: The conversion of identity assurance into a tradable asset, where verified accounts, KYC outcomes, and bypass services are bought and sold. In practice, the control problem shifts from initial proofing to the persistence of trust after an identity has been issued or reused.
• Verification Bypass: Any method that lets an attacker defeat an identity proofing or onboarding step without satisfying its intended assurance level. This includes liveness spoofing, document fabrication, intercepted second factors, and other techniques that create a false appearance of legitimacy.
• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Synthetic Identity Fraud: Synthetic identity fraud is the creation of a fake identity from a mix of real and fabricated personal data. Fraudsters use it to open accounts, build credit, and evade standard checks. Defenders look for thin-file identities, inconsistent identity attributes, repeated reuse of contact details, and unusual account-age patterns across applications.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the operational realities of non-human access and agentic systems.